package main

import (
	"errors"
	"net/http"
	"strings"
)

var tenantScopedCollections = map[string]struct{}{
	"authoring_runs":                   {},
	"pages":                            {},
	"datasources":                      {},
	"scorm_courses":                    {},
	"users":                            {},
	"enrollments":                      {},
	"consent_receipts":                 {},
	"data_subject_requests":            {},
	"webhooks":                         {},
	"entitlements":                     {},
	"billing_customers":                {},
	"billing_events":                   {},
	"notification_templates":           {},
	"notification_preferences":         {},
	"notification_deliveries":          {},
	"notification_queue":               {},
	"notification_delivery_attempts":   {},
	"notification_dead_letters":        {},
	"notification_rate_limit_policies": {},
	"notification_provider_configs":    {},
}

func isTenantScopedCollection(name string) bool {
	_, ok := tenantScopedCollections[name]
	return ok
}

var errTenantClaimRequired = errors.New("tenant claim required for tenant-scoped resources")

func requestTenantScope(r *http.Request, collection string) (tenantID string, enforce bool, err error) {
	if !isTenantScopedCollection(collection) {
		return "", false, nil
	}
	if r == nil {
		return "", false, errTenantClaimRequired
	}
	tenant, ok := r.Context().Value(tenantContextKey).(tenantContext)
	if !ok {
		return "", false, errTenantClaimRequired
	}
	if tenant.BypassScoping {
		if trimmed := strings.TrimSpace(tenant.ID); trimmed != "" {
			return trimmed, tenant.RequestedByOps, nil
		}
		return "", false, nil
	}
	if trimmed := strings.TrimSpace(tenant.ID); trimmed != "" {
		return trimmed, true, nil
	}
	return "", false, errTenantClaimRequired
}